---
layout: docs
page_title: PKI secrets engine
description: Dynamically generate X.509 certificates with the PKI secrets engine plugin.
---

# PKI secrets engine

@include 'x509-sha1-deprecation.mdx'

<Note title="Vault as Consul CA provider">

If you are using Vault 1.11.0+ as a Connect CA, run a Consul version which
includes the fix for [GH-15525](https://github.com/hashicorp/consul/pull/15525).
Refer to this [Knowledge Base
article](https://support.hashicorp.com/hc/en-us/articles/11308460105491) for
more details.

</Note>

The PKI secrets engine generates dynamic X.509 certificates. With this secrets
engine, services can get certificates without going through the usual manual
process of generating a private key and CSR, submitting to a CA, and waiting for
a verification and signing process to complete. Vault's built-in authentication
and authorization mechanisms provide the verification functionality.

By keeping TTLs relatively short, revocations are less likely to be needed,
keeping CRLs short and helping the secrets engine scale to large workloads. This
in turn allows each instance of a running application to have a unique
certificate, eliminating sharing and the accompanying pain of revocation and
rollover.

In addition, by allowing revocation to mostly be forgone, this secrets engine
allows for ephemeral certificates. Certificates can be fetched and stored in
memory upon application startup and discarded upon shutdown, without ever being
written to disk.

## Table of contents

The PKI Secrets Engine documentation is split into the following pieces:

 - [Overview](/vault/docs/secrets/pki) - this document.
 - [Setup and Usage](/vault/docs/secrets/pki/setup) - a brief description of setting
   up and using the PKI Secrets Engine to issue certificates.
 - [Quick Start - Root CA Setup](/vault/docs/secrets/pki/quick-start-root-ca) - A
   quick start guide for setting up a root CA.
 - [Quick Start - Intermediate CA Setup](/vault/docs/secrets/pki/quick-start-intermediate-ca) - A
   quick start guide for setting up an intermediate CA.
 - [Considerations](/vault/docs/secrets/pki/considerations) - A list of helpful
   considerations to keep in mind when using and operating the PKI Secrets
   Engine.
 - [Rotation Primitives](/vault/docs/secrets/pki/rotation-primitives) - A document
   which explains different types of certificates used to achieve rotation.
 - [CIEPS Protocol <EnterpriseAlert inline="true" />](/vault/docs/secrets/pki/cieps) - A
   document which explains the Certificate Issuance External Policy Service (CIEPS)
   protocol (request and response structure), along with an overview of the difference
   between it and `/pki/sign-verbatim`.
 - Issuance Protocols: Using standard certificate management protocols with Vault PKI.
   - [EST <EnterpriseAlert inline="true" />](/vault/docs/secrets/pki/est) - 
     Explains Vault's implementation of the EST protocol, from configuration
     to limitations.
   - [CMPv2 <EnterpriseAlert inline="true" />](/vault/docs/secrets/pki/cmpv2) -
     Explains Vault's implementation of the CMPv2 protocol, from configuration
     to limitations.
   - [Troubleshooting ACME](/vault/docs/secrets/pki/troubleshooting-acme) - A list of
     advice for troubleshooting failures with ACME issuance and Vault PKI.



## Tutorial

Refer to the following tutorials for PKI secrets engine usage examples:

- [Build Your Own Certificate Authority (CA)](/vault/tutorials/secrets-management/pki-engine)
- [Build Certificate Authority (CA) in Vault with an offline Root](/vault/tutorials/secrets-management/pki-engine-external-ca)
- [Enable ACME with PKI secrets engine](/vault/tutorials/secrets-management/pki-acme-caddy)
- [PKI Secrets Engine with Managed Keys](/vault/tutorials/enterprise/managed-key-pki)
- [PKI Unified CRL and OCSP With Cross Cluster
  Revocation](/vault/tutorials/secrets-management/pki-unified-crl-ocsp-cross-cluster)
- [Configure Vault as a Certificate Manager in Kubernetes with
  Helm](/vault/tutorials/kubernetes/kubernetes-cert-manager)
- [Generate mTLS Certificates for Nomad using
  Vault](/vault/tutorials/secrets-management/vault-pki-nomad)


## API

The PKI secrets engine has a full HTTP API. Please see the
[PKI secrets engine API](/vault/api-docs/secret/pki) for more
details.
